NE40/NE80/S8016在版本VRP5.30防攻击的系统Car参数说明

NE40/NE80/S8016在版本VRP5.30防攻击的系统Car参数说明

NE40/NE80/S8016产品在VRP5.30针对出现过多上送主控板的协议报文时，如icmp及telnet、ftp等报文，根据实际情况，需要考虑调整系统Car来为防止攻击，这与VRP3.10的系统漏桶功能类似。

具体可以用display system slot [num] 查看系统Car丢弃计数，对丢弃频繁的系统Car可以进行限流配置。比如：

[NE40] display system slot 4

Apply system information                                     

 #The slot number:   4                            /*板号*/

The Protocol type :ipv4-redirect-icmp                 /*协议类型*/

The time of the last packets arrive: 37252450   /*上次报文到来的时间ms*/

The number of present tokens: 2898                  /*当前剩余的令牌*/

The number of the discarded packets:    1        /*丢弃报文数*/

apply system cir 8k cbs 3000             /*系统Car大小及所允许突发流量*/

 如果丢弃报文数变化比较频繁，则考虑限制此系统Car的通道大小，可能有攻击。一般来说，根据实际业务情况，对相应的系统Car做一定的配置，如对FTP做相应的限制：

[NE40]apply system car 64k cbs 65536 slot 4 type ipv4-redirect-tcp

/*将4号板的ipv4-redirect-tcp 的car配置为64Kbps ，cbs为65536Bytes*/

系统car的报文类型可以通过如下命令查看

[NE40]disp system slot 4 type ?  

  atm-integrated             Include the fllowing two type packet:Atm oam                             packet,Isis packet

  eth-integrated             Include the fllowing four type packet:Eth-trunk                             lacp packet,BPDU protocol packet,HGMP protocol packet,IP multicast packet which destIP address is 224.0.0.18(used by VRRP)

  ipv4-arp-miss              ARP Miss message￡?use it to form ARP entry

  ipv4-arp-nat-address-pool   ARP request packet which destIP is in NAT pool

  ipv4-arp-req               ARP request packet send by all the host￡?use it to learning host route  

  ipv4-fwd-table-vlan        FIB Miss Message use it to form host route entry

  ipv4-gvrp                  GVRP protocol packet

  ipv4-igmp                  Igmp protocol packet

  ipv4-integrated              Include the fllowing four type packet:Rarp packet,Ipv4 packet fib check fail,Ipv4 packet with ttl expired,Packet length exceed MTU and DF flag is set 

  ipv4-mc-builtpkt-register     Mc built register packets      

  ipv4-mc-default            Other IP multicast packet which destIP address is in 224.0.0.0-224.0.0.255(excluded.2 .5 .6 .9 .10 .13 .18)                                          

  ipv4-mc-fwd-miss           Ipv4 multicust packet fib check fail              

  ipv4-mc-fwd-rpf-mismatch   Ipv4 multicust packet rpf check fail               

  ipv4-mc-if-router           IP multicast packet which destIP address is 224.0.0.2(used by IGMP, LDP etc)

  ipv4-mc-ospf               IP multicast packet which destIP address is  224.0.0.5(used by OSPF) 

  ipv4-mc-ospf-dr            IP multicast packet which destIP address is 224.0.0.6(used by OSPF)

  ipv4-mc-pim                IP multicast packet which destIP address is  224.0.0.13(used by PIM)                           

  ipv4-mc-registered          Register packet used in PIM SIM protocol  

  ipv4-mc-rip2               IP multicast packet which destIP address is 224.0.0.9(used by RIP2)                           

  ipv4-option                Ipv4 packet with option  

  ipv4-redirect-default        Packet which destIP is ip address of gateway,                             exclude ICMP and TCP 

  ipv4-redirect-dhcp          DHCP protocol packet 

  ipv4-redirect-icmp         ICMP packet which destIP is ip address of gateway, for example, ping packet  

  ipv4-redirect-rip1         RIP1 protocol packet  

  ipv4-redirect-snmp         SNMP redirect in FIB 

  ipv4-redirect-tcp          TCP packet which destIP is ip address of gateway,  for example, FTP, BGP peer, LDP session 

  isis-packet                ISIS protocol packet 

  mpls-arp-miss             Mpls packet arp miss  

  mpls-integrated          Include the fllowing seven type packet:Mpls packet  label search fail,Mpls packet token search fail,Mpls packet with router alert lable,Mpls packet ttl expired,Mpls packet mtu exceed,Mpls packet forward to cp,Mpls multicust packet

  net-loopback              loopback test packet   

  ppp-ctrl-frame             PPP protocol control frame    

  rpr-ctrl-frame              RPR protocol control frame   

  unknow-packet            Default bucket any packet not list here use this  bucket                                            

  wrap                     wrap packet frome egress to ingress